This was debugged by zhenyu.z.wang@xxxxxxxxx on the open-iscsi lists. When we call scsi_kill_request() we have not yet incremented the device and host busy counters so calling __scsi_done from scsi_kill_request ends up doing extra decrements. This patch has only been compile tested against scsi-misc. I am not sure what the correct blk_complete_barrier_rq values should be. For failures are we supposed to return zero or what is left in the command and what how are we supposed set to indicate a error? Signed-off-by: Mike Christie <michaelc@xxxxxxxxxxx> diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index a7f3f0c..4b6a9fc 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -1514,8 +1514,6 @@ static void scsi_kill_request(struct req { struct scsi_cmnd *cmd = req->special; - blkdev_dequeue_request(req); - if (unlikely(cmd == NULL)) { printk(KERN_CRIT "impossible request in %s.\n", __FUNCTION__); @@ -1523,9 +1521,19 @@ static void scsi_kill_request(struct req } scsi_init_cmd_errh(cmd); - cmd->result = DID_NO_CONNECT << 16; atomic_inc(&cmd->device->iorequest_cnt); - __scsi_done(cmd); + + blkdev_dequeue_request(req); + req->errors = DID_NO_CONNECT << 16; + + if (blk_complete_barrier_rq(q, req, cmd->bufflen >> 9)); + return; + + scsi_release_buffers(cmd); + while (end_that_request_first(req, 0, req->nr_sectors)) + ; + end_that_request_last(req); + scsi_put_command(cmd); } /* - : send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html